Handy commands:
lsblk
udevadm info --query=all --name=/dev/sd<X> | grep ID_SERIAL_SHORT
Handy Commands:
apt-get install gnome-disk-utility
gnome-disks
apt-get install smartmontools
smartctl -H /dev/sd<X>
smartctl -i /dev/sd<X>
gnome-disks
Open “SMART Data & Self-Tests”, click “Start Self-Test”, and select a test to run.
smartctl --test=short /dev/sd<X>
smartctl --test=long /dev/sd<X>
badblocks -vws /dev/sd<X>
If the hardware is suspect, then the first thing to do is get a byte-for-byte copy of the drive's contents into a disk image file. The less time spent using possibly faulty hardware the better. For this, use ddrescue
instead of dd
, as ddrescue
will repeatedly try to recover from errors as it tried to salvage data, whereas dd will simply fail.
apt-get install gddrescue ddrescue -A -f /dev/sd<X> broken.img
This copy will remain unchanged while we work. Make a copy of this file, and only alter the copy. This way, if anything goes awry then we can go back to square one without having to rely on possibly faulty hardware again.
cp broken.img work.img
Use testdisk to search for and repair disk partitions.
apt-get install testdisk testdisk work.img
Using testdisk involves using the arrow, escape, and enter keys.
Use photorec to recover deleted files.
mkdir RECOVERY RECOVERY/DELETED RECOVERY/RECOVERED
photorec work.img
Files that the filesystem thinks have been deleted are now stored in RECOVERY/DELETED/
. Filenames are most likely trashed, so the only way to identify a file is to open it up.
Recover other files:
fdisk -lu work.img Disk work.img: 1.9 GiB, 2055208960 bytes, 4014080 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type work.img1 63 4014079 4014017 1.9G 5 Extended work.img5 496 4014079 4013584 1.9G 6 FAT16
OFFSET = SECTOR-SIZE * START = 512 * 496 = 253952
losetup -o 253952 /dev/loop0 work.img
fsck -y /dev/loop0 2>&1 | tee fsck.log
mount -o ro /dev/loop0 /mnt
RECOVERY/RECOVERED
:cd RECOVERY/RECOVERED ; (cd / && tar -cvf - mnt) | tar -xvBpf - 2>&1 | tee ../tar.log
grep ^tar: ../tar.log
find . -size 0 -ls 2>&1 | tee ../zero-size.log
umount /mnt
losetup -d /dev/loop0
Final contents of RECOVERY
directory:
RECOVERY/DELETED
– Files recovered that the filesystem previously thought had been deleted.RECOVERY/RECOVERED
– Files that could be copies off of the disk image. Some files may be corrupt though.RECOVERY/RECOVERED
. Any files that could not be copied are listed here and may be found with grep ^tar: log.tar
.RECOVERY/RECOVERED
that are empty.